helixar-ai/Artifact Policy Engine
Scan, harden, sign, and verify release artifacts before they ship.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to artifact directory or archive to scan | no | ./dist |
| config | Path to .releaseguard.yml config file | no | .releaseguard.yml |
| fail-on | Severity levels that fail the build (critical, high, medium, low). Configure this in .releaseguard.yml under policy.fail-on — the CLI reads it from config, not from a command-line flag. | no | critical,high |
| sbom | Generate a Software Bill of Materials | no | false |
| fix | Apply safe hardening transforms before scanning | no | false |
| obfuscation | Obfuscation level (none, light — medium/aggressive require Cloud) | no | none |
| sign | Sign the artifact after scanning (keyless, local, none) | no | none |
| format | Report format (cli, json, sarif, html) | no | sarif |
| create-issues | Automatically create a GitHub issue when critical vulnerabilities are found. Requires the workflow token to have issues:write permission. | no | false |
| token | ReleaseGuard Cloud API token (optional — enables Cloud features) | no | "" |
| artifact-name | Name for the uploaded evidence bundle artifact. Override when calling ReleaseGuard multiple times in the same workflow run to avoid 409 conflicts. | no | releaseguard-evidence |
Outputs
| name | description |
|---|---|
| result | Policy result (pass, warn, fail) |
| report-path | Path to generated report file |
| evidence-dir | Path to evidence bundle directory |